usnistgov/macos_security
1
0
Fork 0
mirror of https://github.com/usnistgov/macos_security.git synced 2026-08-11 23:41:45 +01:00
Code Issues 21 Actions Packages Projects Releases Wiki Activity

sync changes in Sonoma

Browse Source
This commit is contained in:
Dan Brodjieski
2024-02-23 16:01:16 -05:00
parent 9d1be20480
commit 0989ac7cb6
1 changed files with 12 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
rules/os/os_unlock_active_user_session_disable.yaml
View File

@@ -1,19 +1,19 @@
id: os_unlock_active_user_session_disable
title: "Disable Login to Other User's Active and Locked Sessions"
discussion: |
The ability to log in to another user's active or locked session _MUST_ be disabled.
macOS has a privilege that can be granted to any user that will allow that user to unlock active user's sessions. Disabling the admins and/or user's ability to log into another user's active andlocked session prevents unauthorized persons from viewing potentially sensitive and/or personal information.
The ability to log in to another user's active or locked session _MUST_ be disabled.
NOTE: Configuring this setting will disable TouchID from unlocking the screensaver.
macOS has a privilege that can be granted to any user that will allow that user to unlock active user's sessions. Disabling the admins and/or user's ability to log into another user's active and locked session prevents unauthorized persons from viewing potentially sensitive and/or personal information.
NOTE: Configuring this setting will change the user experience and disable TouchID from unlocking the screensaver. To restore the user experience and allow TouchID to unlock the screensaver, you can run `/usr/bin/sudo /usr/bin/defaults write /Library/Preferences/com.apple.loginwindow screenUnlockMode -int 1`. This setting can also be deployed with a configuration profile.
check: |
/usr/bin/security authorizationdb read system.login.screensaver 2>&1 | /usr/bin/grep -c '<string>authenticate-session-owner</string>'
/usr/bin/security authorizationdb read system.login.screensaver 2>&1 | /usr/bin/grep -c '<string>$ODV</string>'
result:
integer: 1
fix: |
[source,bash]
----
/usr/bin/security authorizationdb write system.login.screensaver "authenticate-session-owner"
/usr/bin/security authorizationdb write system.login.screensaver "$ODV"
----
references:
cce:
@@ -40,6 +40,12 @@ references:
- 4.3
macOS:
- "12.0"
odv:
hint: "Review the /System/Library/Security/authorization.plist file for more information."
recommended: "authenticate-session-owner"
cis_lvl1: "use-login-window-ui"
cis_lvl2: "use-login-window-ui"
stig: "authenticate-session-owner"
tags:
- 800-53r5_low
- 800-53r5_moderate